By Kareena Bavisi
It comes down to one number: what your worst incident would cost, and how much of it the business can carry on its own. With a CISO, that’s usually a risk decision. Without one, cyber insurance may only be a compliance purchase.
Before deciding whether to buy cyber insurance, a business needs one number: what its worst incident would cost. When I spoke with Gregory Eskins, who leads Marsh’s Global Cyber Insurance Center, that was where he said a first-time buyer should start. He doesn’t assume every business should buy it. He starts with how much loss a business could absorb on its own, then asks whether the cost of covering the rest makes sense.
How a business gets to that answer depends on who is making the call. Organizations with a CISO tend to be engaged and aware of the risk, and many are on a journey toward resilience. Organizations without one, whether because they lack the resources or because insurance is a compliance requirement for them, face the same decision with less security expertise in the room.
What moves clients to act is usually an event. Cyber risk, Eskins told me, has always been “intellectually understood, I would say, by most organizations, but it’s not been felt personally.” When a real incident hits the news, clients ask about it and whether they’re covered, and AI is making the risk more real to them. That is a reactive way to make a decision about money and risk.
Two kinds of buyers
Start with organizations that have a CISO. They tend to be the engaged ones, and insurers pull them into the conversation because underwriting is technical. They understand the realities of their organizations best, and many are on a journey toward resilience.
Organizations without one are a different story. Some lack the resources for a CISO. Some buy cyber insurance mainly because they have to. That does not track neatly with size or sophistication, and there is nothing wrong with it. For some smaller organizations, insurance is a compliance tool, and, as Eskins shared, buyers generally still get a good product even without understanding everything in it.
The catch is what happens next. Without someone whose job is to keep the exposure in front of leadership, cyber risk tends to stay abstract until a headline makes it real. AI is part of the reason that is changing. As Eskins puts it, “it’s in the headlines all the time. Fear is a strong motivator.” That fear is pulling more organizations into the conversation. For a company with a CISO, it lands on a process already in motion. For one without, it tends to produce a reaction instead of a plan.
Start with your own number
A cyber insurance decision is two questions in sequence. How much loss can the business absorb? And what would it cost to hand off the rest? Plenty of buyers jump to the second one and start comparing quotes, which lets a renewal date or a questionnaire set the limit instead of the company’s own exposure.
The first question needs a worst case and a figure, and the figure matters because the range is wide. Eskins frames it as whether the loss is “a 5 million dollar risk or is that a 50 or $500 million risk?” Good security shrinks that number but never erases it. Some residual risk stays with the business, and that remainder is what the decision is about.
From there it comes down to tolerance. If the business can carry the remainder comfortably, declining coverage is a defensible call. If it can’t, the policy is worth pricing, and the comparison that counts is what covering the remainder costs against what leaving it uncovered could cost. That is why insurance is optional and the number is not. In Eskins’ words, “the question is not should you buy insurance for that, but what is your risk tolerance.”
Pricing the rest is the easier half. The next step is to find out whether coverage exists for that remainder and what it would cost “relative to the risk that you would be otherwise accepting.” In many cases, Eskins says, transferring that risk is “incredibly capital efficient.” Whether it is for your business comes down to quotes and policy language, so compare quotes and read the exclusions before deciding.
AI raises the cost of weak basics
AI has not created a whole new category of cyber risk. It has made weak fundamentals more expensive. Eskins is direct about it: “The foundations and fundamentals of strong cybersecurity still matter. In fact, they’re more important than ever.” Attackers now have tools that work at speed and scale, and a company with weak basics is at a serious disadvantage against them.
The worry is running ahead of the data. So far Marsh has not seen a dramatic increase in events overall, though attack speed and scale are expected to rise, and the firm is working with clients to help them get ahead of it.
What a security team should be ready to explain follows from that. A company deploying AI agents to automate workflows needs a clear account of identity and access, meaning what each agent can reach and why, with permissioning and segmentation behind it. That is incredibly important. Keeping that account current is the working core of AI governance: which agents are running, what each can touch, and who answers for it. Faster patching helps, but it can’t be the whole answer.
AI also cuts the other way. It amplifies familiar risks, and it mitigates them too. The question for a security team is whether it is using AI itself, for reconnaissance and threat hunting, to move at greater speed and scale.
Strong security earns something steadier than a discount. Market conditions, mainly supply and demand, move price more than any single company’s controls can, but good cybersecurity and governance help a business “smooth out some of those ebbs and flows of volatility.”
What CISOs can do differently
The most useful step is also the cheapest: ask. “Do not be afraid to ask your underwriter questions,” Eskins says, about the policy itself and about the market. People on the other side are generally generous with the information they want to provide.
That openness reflects how the relationship has changed. Insurance used to be seen as a drain on the security budget, or, wrongly, as an indictment of the security program. Now, Eskins says, “it’s far more of a game of cooperation and collaboration.”
It also runs both ways. Marsh wants to hear what frustrates CISOs about claims or how a policy needs to evolve, and works on ways of dealing with it. Raising it, instead of absorbing it until the next renewal, is the other half of engagement.
The steps themselves are short: quantify the worst case, decide how much of it the business can carry, and ask the people who price the risk what it would take to cover the rest. None of it needs new spend or new tooling. In an organization without a CISO, the same steps fall to whoever owns the insurance decision.
Asking well takes fluency, and fluency is not evenly spread. Eskins told me CISOs have been great partners, asking lots of questions and wanting to learn. He also acknowledged that clients can find it harder to get educated on this, with products still evolving and a lot to digest, and he called helping them part of Marsh’s job. In my view, that points to a gap. Where a CISO is in the seat, that learning is usually underway. Where one is not, the person signing the policy may never have been taught how underwriters think or what moves a price. At bottom it is a communication gap: security teams and underwriters often describe the same risk in different terms. Training built around cyber insurance is starting to appear to bridge it, aimed at exactly that reader.
Decide before the headline does
Cyber risk will keep making the news, and each incident will keep sending clients to their brokers to ask whether they are covered. Organizations that wait for that moment decide under pressure. Organizations that have already priced their worst day, and asked an underwriter what covering the rest would cost, decide on their own terms.
Cyber insurance may be optional. Knowing what you can afford to lose is not.
Kareena Bavisi
Kareena Bavisi is a contributor to CISO MAG covering cybersecurity and AI, writing on how emerging technology is reshaping risk, governance, and the way enterprises defend themselves. Her work draws on conversations with security leaders, insurers, and technologists across the industry to surface the trends shaping the field. She is also Chief of Staff to the CEO and Founder at EC-Council, a global leader in cybersecurity certification and education.
